OS Command Injection

What it is

CWE-78 exists when an application passes user-controlled data to a system shell or external process without proper neutralization. The attacker injects shell metacharacters (;, &&, |, backticks) that cause the operating system to execute additional commands beyond the intended one.

Why it matters

OS command injection often grants remote code execution as the application's service account. In container deployments, this typically means escape paths into the container's tooling and credentials. In serverless or Lambda-style environments, it can leak ephemeral IAM credentials. Command injection is consistently in the CWE Top 25 and is responsible for some of the most consequential breaches in the historical record.

Common patterns

• •child_process.exec or os.system called with a string built from user input.
• •Image, video, or document processing pipelines that shell out to ImageMagick, ffmpeg, or LibreOffice with filenames from uploads.
• •Git commands constructed from user-controlled branch or repo names.
• •DNS, network, or system-info CLIs called from web admin panels (ping, nslookup, whois).
• •Backup or restore scripts triggered from web UIs.

Languages affected

Example

const { exec } = require('child_process')

app.get('/ping', (req, res) => {
  exec(`ping -c 1 ${req.query.host}`, (err, stdout) => {
    res.send(stdout)
  })
})

const { execFile } = require('child_process')

app.get('/ping', (req, res) => {
  if (!/^[a-zA-Z0-9.-]+$/.test(req.query.host)) {
    return res.status(400).send('Invalid host')
  }
  execFile('ping', ['-c', '1', req.query.host], (err, stdout) => {
    res.send(stdout)
  })
})

Where this fits in OWASP Top 10

Compliance framework mapping

Related CWEs